dregsy

• check for gcr.io as domain, as well as for .gcr.io as domain suffix (PR #110)
• corrected logic for setting GCR refresher, to allow using public GCR without authentication (PR #109)

• Go 1.21.6
• latest Ubuntu 22.04 and Alpine 3.18
• Skopeo 1.14.1
• misc. lib upgrades for remediation of CVEs in dependencies

• Go 1.20.2
• latest Ubuntu 22.04 and Alpine 3.17
• Skopeo 1.11.2

• Go 1.20.1
• latest Ubuntu 22.04 and Alpine 3.17
• Skopeo 1.11.1
• misc. lib upgrades for CVE remediation

• Go 1.18.8
• latest Ubuntu 22.04 (remediates CVE-2022-3602 and CVE-2022-3786)
• Alpine 3.16
• Skopeo 1.9.3

• Improper Input Validation in GoGo Protobuf
• containerd CRI plugin: Insecure handling of image volumes
• containerd CRI plugin: Host memory exhaustion through ExecSync

• Go 1.18
• Ubuntu 22.04 and Alpine 3.15
• Skopeo 1.8.0 (own build)

• OCI Manifest Type Confusion Issue
• Ambiguous OCI manifest parsing
• Clarify mediaType handling
• Insufficiently restricted permissions on plugin directories

• switched to Go 1.17
• Ubuntu 20.04 and Alpine 3.14 to latest container images

• building on non-Linux platforms (issue #61)

• CVE-2020-26160, github.com/dgrijalva/jwt-go
• GHSA-c72p-9xmj-rx3w, github.com/containerd/containerd

• Skopeo to 1.3.1 (Alpine) & 1.3.0 (Ubuntu)
• Alpine to 3.14.0
• Ubuntu 20.04 to latest container image

switched to Go 1.13 & modules

removed Skopeo submodule: The Skopeo project is phasing out static builds, so the previous approach of building a FROM scratch image for dregsy with just the two binaries no longer works. Instead, Alpine is now used as the base, and Skopeo is installed during image build via apk (see Dockerfile for version information).

Important - breaking change: The dregsy binary is now located at /usr/local/bin inside the image. You may need to adjust how you invoke dregsy.

support for AWS China ECR

doc updates

fix for issue #4: canonicalize image refs before matching